<?php
include_once "function_xml_basic.php";
include_once "function_xml_atom.php";
include_once "function_obj_analyse.php";
include_once "function_base_xml_class.php";

class CNat extends base_xml_class
{
	function __construct()
	{
		$this->root_path = "/MINI/SECURITY/POLICY/NATS";
		$this->node_name = "NAT";
		$this->key_array = array("Name", "InDev", "OutDev", "SrcAddr", "DstAddr", 
				    	  "DstPort", "SrcPort",  "Proto", 
			   		  "CvtSrcPort", "CvtDstPort", 
			   		  "CvtDstAddr", "CvtSrcAddr", 
			   		  "NatType", "Enabled");
	}
	
	function Apply()
	{
		$command  = "/usr/local/bin/iptables -t nat -F USERSNAT;";
		$command .= "/usr/local/bin/iptables -t nat -F USERDNAT;";
		/*
		include_once "function_sys_license.php";
		$license = CheckSysLicenseForRule();
		if ($license == FALSE)
		{
			return ;
		}
		*/
		$list = $this->get_list();
		foreach ($list as $l){
			$ret_command = $this->CreateApplyNatString($l);
			$command .= $ret_command;
		}
		//print $command;
		$ret = shell_exec($command);
		return $ret;
	}
	
	function CreateApplyNatString($list)
	{
		$iptables = "/usr/local/bin/iptables  ";
		if ($list['Enabled'] == 0)
			return ;

		if ($list['InDev'] == '' || $list['InDev'] == 'All')
			$indev = "";
		else
			$indev = " -i ". $list['InDev'];
		
		if ($list['OutDev'] == '' || $list['OutDev'] == 'All')
			$outdev = "";
		else
			$outdev = " -o ". $list['OutDev'];

		// ------ Source address ------
		$value_xml = "";
		$value_xml = $list['SrcAddr'];
		$srcaddr_list = GetSourceIpList($value_xml);
		//print_r($srcaddr_list);

		// ------ Des address ------
		$value_xml = "";
		$value_xml = $list['DstAddr'];
		$dstaddr_list = GetDestIpList($value_xml);
		//print_r($dstaddr_list);

		// ------ Cvt Source address ------
		$value_xml = "";
		$value_xml = $list['CvtSrcAddr'];
		$cvt_srcaddr_list = GetIpListForNat($value_xml, "");
		//print_r($cvt_srcaddr_list);

		// ------ Cvt Dst address ------
		$value_xml = "";
		$value_xml = $list['CvtDstAddr'];
		$cvt_dstaddr_list = GetIpListForNat($value_xml, "");
		//print_r($cvt_dstaddr_list);

		if ($list['Proto'] == '' || $list['Proto'] == 'All')
		{
			$proto = "";
			$srcport = "";
			$dstport = "";
			$str_cvt_src_port = "";
			$str_cvt_dst_port = "";
		}
		else
		{
			$proto = " -p ". $list['Proto']. " ";
			
			if ($list['Proto'] == 'tcp' || $list['Proto'] == 'udp')
			{
				if ($list['SrcPort'] != '')
					$srcport = " --sport ". $list['SrcPort'];
				else
					$srcport = "";

				if ($list['DstPort'] != '')
					$dstport = " --dport ". $list['DstPort'];
				else
					$dstport = "";

				if ($list['CvtSrcPort'] == "nochange" || $list['CvtSrcPort'] == "")
				{
					$str_cvt_src_port = "";
				}
				else
					$str_cvt_src_port = ":". $list['CvtSrcPort'];

				if ($list['CvtDstPort'] == "nochange" || $list['CvtDstPort'] == "")
				{
					$str_cvt_dst_port = "";
				}
				else
					$str_cvt_dst_port = ":". $list['CvtDstPort'];
			}	
		}

		$command = "";
		$command_snat = "";
		$command_dnat = "";

		foreach( $srcaddr_list as $src)
		{
			$str_srcaddr = $src;
			
			foreach ( $dstaddr_list as $dst)
			{
				$str_dstaddr = $dst;
				
				foreach ($cvt_srcaddr_list as $cvt_srcaddr)
				{
					$str_cvt_srcaddr = $cvt_srcaddr;

					foreach ($cvt_dstaddr_list as $cvt_dstaddr)
					{
						$str_cvt_dstaddr = $cvt_dstaddr;

						if ($list['NatType'] == 1 || $list['NatType'] == 3) // S_nat SD_nat
						{
							$command_snat .= $iptables. " -t nat -A USERSNAT ";
							$str_snat = " -j SNAT --to-source ";
							if ($str_cvt_srcaddr == ' ' && $str_cvt_src_port == '')
							{
								$operate1 .= " -j ACCEPT ;";
							}
							else if ($str_cvt_srcaddr == " MASQUERADE") {
								$operate1 .= " -j MASQUERADE ;";
							}
							else
							{
								$operate1 .= $str_snat. $str_cvt_srcaddr. $str_cvt_src_port. "; ";
							}

							$str_init = $outdev. $proto. $dstport. $srcport;
							$command_snat .= $str_init. $str_srcaddr. $str_dstaddr. $operate1;
							//print "SNAT:". $command_snat. "\n\n\n";
						}
						if ($list['NatType'] == 2 || $list['NatType'] == 3) // D_nat SD_nat
						{
							$command_dnat .= $iptables. " -t nat -A USERDNAT ";
							$str_dnat = " -j DNAT --to-destination ";

							if ($str_cvt_dstaddr == ' ' && $str_cvt_dst_port == '')
							{
								$operate2 .= " -j ACCEPT ;";
							}
							else
							{
								$operate2 .= $str_dnat. $str_cvt_dstaddr. $str_cvt_dst_port. "; ";
							}

							$str_init = $indev. $proto. $dstport. $srcport;
							$command_dnat .= $str_init. $str_srcaddr. $str_dstaddr. $operate2;
							//print "DNAT:". $command_dnat. "\n\n\n";
						}
						$command .= $command_dnat. $command_snat;
					}
				}
			}
		}
		//print  $command. "\n";
		return $command;
	}
}

//$cnat = new CNat();
//$cnat->Apply();

$root_path = "/MINI/SECURITY/POLICY/NATS";
$iptables = "/usr/local/bin/iptables -t nat ";

function GetXmlSecNatByName($name)
{
	$ret_array = GetXmlSecNatList();
    
        foreach ($ret_array as $ret)
        {   
                if ($ret['Name'] == $name)
                        return $ret;
        }   
        return NULL;

}

function GetXmlSecNatList()
{
	global $root_path;
	$query_string = $root_path. "/NAT";
	$key_array = array("Name", "InDev", "OutDev", "SrcAddr", "DstAddr", 
			   "DstPort", "SrcPort",  "Proto", 
			   "CvtSrcPort", "CvtDstPort", 
			   "CvtDstAddr", "CvtSrcAddr", 
			   "NatType", "Enabled");
	return GetAttributList($query_string, $key_array);
}
/*
$ret_list = GetXmlSecNatList();
foreach ($ret_list as $ret)
{
	print $ret['Name'];
}
*/

function GetXmlSecObjcetNameList()
{
	$name_list = array();
	$temp_array = GetXmlSecObjectList();
	
	$i = 0;
	foreach ($temp_array as $tmp)
	{
		$name_list[$i ++] = $tmp['Name'];
	}
	return $name_list;
}

function GetXmlNumberSecNats()
{
	global $root_path;
	$query_string = $root_path. "/NAT";
	return GetNumberOfNode($query_string);
}

function GetXmlSecObjectContentList($name)
{
	$object = GetXmlSecGroupByName($name);
	$tmp_string = $object['ObjectList'];
	$list = explode(',', $tmp_string);
	#foreach ($list as $i)
	#	print "[". $i. "]\n";
	return $list;
}

function DelXmlSpecialOneSecNat($name)
{
	global $root_path;

	$query_string = $root_path. "/NAT[@Name='". $name. "']";
	DelSpecialNode($query_string);
	ApplySecNatRule();
}

function AppendXmlSecOneNat($in_array)
{
	global $root_path;
        $node_name = "NAT";
	$query_string = $root_path;
	$in_array['Type'] = "1";
	AppendAllAttrOfNode($query_string, $node_name, $in_array);
	ApplySecNatRule();
}

function InsertXmlSecOneNat($number, $in_array)
{
	global $root_path;
	$node_name = "NAT";
	$query_string_from = $root_path. '/NAT['. $number. ']';
	//print $query_string_from;
	InsertOneNode($query_string_from, $node_name, $in_array);
	ApplySecNatRule();
}

function SetXmlSecOneNat($in_array)
{
	global $root_path;
	$name = $in_array['Name'];
	$in_array['Type'] = "1";
	$query_string = $root_path. "/NAT[@Name='". $name. "']";

	EditAllAttrOfNode($query_string, $in_array);
	ApplySecNatRule();
}


function MoveXmlOneSecNat($from, $to)
{
	global $root_path;
	$query_string_from = $root_path.  "/NAT". "[". $from. "]";
	$query_string_to= $root_path. "/NAT". "[". $to. "]";
	
	if ($from == $to)
		return SUCCESS;

	$number = GetXmlNumberSecNats();
	
	if ($from > $number || $to > $number)
		return ERR_VALUE;

	if ($from > $to)
	{
		MoveFrontOneNode($query_string_from, $query_string_to);
	}
	else
	{
		if ($to < $number)
		{
			$query_string_to= $root_path. "/NAT". "[". ($to + 1 ). "]";
			MoveFrontOneNode($query_string_from, $query_string_to);
		}
		else
		{
			MoveEndOneNode($query_string_from, $query_string_to);
		}
	}
	ApplySecNatRule();
	return SUCCESS;
}

function DelXmlAllSecNats()
{
	global $root_path;
	$query_string = $root_path. "/NAT";
	DelSpecialNode($query_string);
	ApplySecNatRule();
}

function GetXmlSecGroupByName($name)
{
	$ret_array = GetXmlSecGroupList();
    
        foreach ($ret_array as $ret)
        {   
                if ($ret['Name'] == $name)
                        return $ret;
        }   
        return NULL;

}

function GetXmlSecGroupList()
{
	global $root_path;
	$query_string = $root_path. "/GROUP/OBJECT";
	$key_array = array('Name', 'ObjectList', 'ObjectType');
	return GetAttributList($query_string, $key_array);
}

function SetXmlSecGroup($in_array)
{
	global $root_path;
	$in_array['ObjectType'] = "1";
	$query_string = $root_path. "/GROUP/OBJECT[@Name='". $in_array['Name']. "']";
	EditAllAttrOfNode($query_string, $in_array);
}

function DelXmlSpecialOneSecGroup($name)
{
	global $root_path;

	$query_string = $root_path. "/GROUP/OBJECT[@Name='". $name. "']";
	DelSpecialNode($query_string);
}

function FlushAllSecNatRule()
{
	global $iptables;
	$command = "";
	$command = $iptables. " -t nat -F USERSNAT & > /dev/null; ". $iptables. " -t nat -F USERDNAT & >/dev/null; ";
	$ret = shell_exec($command);
	return $ret;
}

function ApplySecNatRule()
{
	global $iptables;
	
	FlushAllSecNatRule();
	
	$command = "";
	$ret_list = GetXmlSecNatList();

	foreach ($ret_list as $ret)
	{
		$ret_string = "";
		$ret_string = ApplyOneSecNatRule($ret);
        	$command .= $ret_string;
	} 
	//print $command;
	$ret = shell_exec($command);
	return $ret;
}

function ApplyOneSecNatRule($list)

{
;
}

?>
